From 4aba254975de58613e04e494bb9f8a46105b9f57 Mon Sep 17 00:00:00 2001 From: Valentin Samir Date: Wed, 1 Jan 2020 11:52:31 +0100 Subject: [PATCH 01/13] Update tox.ini to use python3 for flake8, check_rst and coverage --- tox.ini | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tox.ini b/tox.ini index ab93ef5..ff5e1db 100644 --- a/tox.ini +++ b/tox.ini @@ -121,7 +121,7 @@ deps = [testenv:flake8] -basepython=python +basepython=python3 deps=flake8 skip_install=True commands= @@ -130,7 +130,7 @@ commands= whitelist_externals={[post_cmd]whitelist_externals} [testenv:check_rst] -basepython=python +basepython=python3 deps= docutils Pygments @@ -142,7 +142,7 @@ commands= whitelist_externals={[post_cmd]whitelist_externals} [testenv:coverage] -basepython=python +basepython=python3 passenv= COVERAGE_TOKEN CI_BUILD_REF_NAME From 781e516769fc48f052c7448e8a2e2b7530d819f3 Mon Sep 17 00:00:00 2001 From: Valentin Samir Date: Wed, 1 Jan 2020 12:14:44 +0100 Subject: [PATCH 02/13] Update .travis.yml to use python3 for flake8, check_rst and coverage --- .travis.yml | 6 +++--- .update_coverage | 10 +++++++--- 2 files changed, 10 insertions(+), 6 deletions(-) diff --git a/.travis.yml b/.travis.yml index 5b8a997..d2b02b2 100644 --- a/.travis.yml +++ b/.travis.yml @@ -1,9 +1,9 @@ language: python matrix: include: - - python: "2.7" + - python: "3.7" env: TOX_ENV=flake8 - - python: "2.7" + - python: "3.7" env: TOX_ENV=check_rst - python: "2.7" env: TOX_ENV=py27-django111 @@ -19,7 +19,7 @@ matrix: env: TOX_ENV=py35-django21 - python: "3.6" env: TOX_ENV=py36-django21 - - python: "2.7" + - python: "3.7" env: TOX_ENV=coverage cache: directories: diff --git a/.update_coverage b/.update_coverage index 402179c..0c51404 100755 --- a/.update_coverage +++ b/.update_coverage @@ -1,5 +1,7 @@ #!/bin/bash -BASEDIR="$1" +set -x +set -e +BASEDIR="$(realpath "$1")" PROJECT_NAME="$2" TITLE="Coverage report of $PROJECT_NAME" @@ -31,7 +33,7 @@ fi VENV="$(mktemp -d)" HTMLREPORT="$(mktemp -d)" -virtualenv "$VENV" +virtualenv -p python3 "$VENV" "$VENV/bin/pip" install coverage "$VENV/bin/coverage" html --title "$TITLE" --directory "$HTMLREPORT" rm -rf "$VENV" @@ -43,12 +45,14 @@ cd "$BASEDIR" rm -rf "$HTMLREPORT" - +set +x +echo "curl https://badges.genua.fr/coverage/ ..." curl https://badges.genua.fr/coverage/ \ -F "secret=$COVERAGE_TOKEN" \ -F "tar=@$BASEDIR/coverage.tar.gz" \ -F "project=$PROJECT_NAME" \ -F "branch=$BRANCH" +set -x rm "$BASEDIR/coverage.tar.gz" From aa88bf7a67af9f6017e58846850b7a89002f84f8 Mon Sep 17 00:00:00 2001 From: erdnaxe Date: Sat, 25 Jan 2020 10:58:23 +0000 Subject: [PATCH 03/13] Bootstrap 4 templates (#47) --- README.rst | 15 ++- cas_server/default_settings.py | 10 +- .../static/cas_server/{ => bs3}/styles.css | 0 cas_server/static/cas_server/bs4/fa-lock.svg | 2 + cas_server/static/cas_server/bs4/fa-user.svg | 2 + cas_server/static/cas_server/bs4/styles.css | 34 +++++++ .../templates/cas_server/{ => bs3}/base.html | 2 +- .../templates/cas_server/{ => bs3}/form.html | 0 .../cas_server/{ => bs3}/logged.html | 2 +- .../templates/cas_server/{ => bs3}/login.html | 4 +- .../cas_server/{ => bs3}/logout.html | 2 +- .../templates/cas_server/{ => bs3}/warn.html | 4 +- cas_server/templates/cas_server/bs4/base.html | 91 +++++++++++++++++++ cas_server/templates/cas_server/bs4/form.html | 33 +++++++ .../templates/cas_server/bs4/logged.html | 21 +++++ .../templates/cas_server/bs4/login.html | 33 +++++++ .../templates/cas_server/bs4/logout.html | 7 ++ cas_server/templates/cas_server/bs4/warn.html | 11 +++ 18 files changed, 257 insertions(+), 16 deletions(-) rename cas_server/static/cas_server/{ => bs3}/styles.css (100%) create mode 100644 cas_server/static/cas_server/bs4/fa-lock.svg create mode 100644 cas_server/static/cas_server/bs4/fa-user.svg create mode 100644 cas_server/static/cas_server/bs4/styles.css rename cas_server/templates/cas_server/{ => bs3}/base.html (98%) rename cas_server/templates/cas_server/{ => bs3}/form.html (100%) rename cas_server/templates/cas_server/{ => bs3}/logged.html (95%) rename cas_server/templates/cas_server/{ => bs3}/login.html (91%) rename cas_server/templates/cas_server/{ => bs3}/logout.html (76%) rename cas_server/templates/cas_server/{ => bs3}/warn.html (75%) create mode 100644 cas_server/templates/cas_server/bs4/base.html create mode 100644 cas_server/templates/cas_server/bs4/form.html create mode 100644 cas_server/templates/cas_server/bs4/logged.html create mode 100644 cas_server/templates/cas_server/bs4/login.html create mode 100644 cas_server/templates/cas_server/bs4/logout.html create mode 100644 cas_server/templates/cas_server/bs4/warn.html diff --git a/README.rst b/README.rst index 7f2c767..63aa0bb 100644 --- a/README.rst +++ b/README.rst @@ -207,13 +207,16 @@ Template settings * ``CAS_SHOW_POWERED``: Set it to ``False`` to hide the powered by footer. The default is ``True``. * ``CAS_COMPONENT_URLS``: URLs to css and javascript external components. It is a dictionnary having the five following keys: ``"bootstrap3_css"``, ``"bootstrap3_js"``, - ``"html5shiv"``, ``"respond"``, ``"jquery"``. The default is:: + ``bootstrap4_css``, ``bootstrap4_js``, ``"html5shiv"``, ``"respond"``, ``"jquery"``. + The default is:: { "bootstrap3_css": "//maxcdn.bootstrapcdn.com/bootstrap/3.3.6/css/bootstrap.min.css", "bootstrap3_js": "//maxcdn.bootstrapcdn.com/bootstrap/3.3.6/js/bootstrap.min.js", "html5shiv": "//oss.maxcdn.com/libs/html5shiv/3.7.0/html5shiv.js", "respond": "//oss.maxcdn.com/libs/respond.js/1.4.2/respond.min.js", + "bootstrap4_css": "//stackpath.bootstrapcdn.com/bootstrap/4.4.1/css/bootstrap.min.css", + "bootstrap4_js": "//stackpath.bootstrapcdn.com/bootstrap/4.4.1/js/bootstrap.min.js", "jquery": "//code.jquery.com/jquery.min.js", } @@ -245,17 +248,19 @@ Template settings * ``CAS_INFO_MESSAGES_ORDER``: A list of message names. Order in which info-box messages are displayed. Use an empty list to disable messages display. The default is ``[]``. * ``CAS_LOGIN_TEMPLATE``: Path to the template showed on ``/login`` then the user - is not autenticated. The default is ``"cas_server/login.html"``. + is not autenticated. The default is ``"cas_server/bs4/login.html"``. * ``CAS_WARN_TEMPLATE``: Path to the template showed on ``/login?service=...`` then the user is authenticated and has asked to be warned before being connected - to a service. The default is ``"cas_server/warn.html"``. + to a service. The default is ``"cas_server/bs4/warn.html"``. * ``CAS_LOGGED_TEMPLATE``: Path to the template showed on ``/login`` then to user is - authenticated. The default is ``"cas_server/logged.html"``. + authenticated. The default is ``"cas_server/bs4/logged.html"``. * ``CAS_LOGOUT_TEMPLATE``: Path to the template showed on ``/logout`` then to user - is being disconnected. The default is ``"cas_server/logout.html"`` + is being disconnected. The default is ``"cas_server/bs4/logout.html"`` * ``CAS_REDIRECT_TO_LOGIN_AFTER_LOGOUT``: Should we redirect users to ``/login`` after they logged out instead of displaying ``CAS_LOGOUT_TEMPLATE``. The default is ``False``. +Note that the old bootstrap3 template is available in ``cas_server/bs3/`` + Authentication settings ----------------------- diff --git a/cas_server/default_settings.py b/cas_server/default_settings.py index 14b2352..8e72b54 100644 --- a/cas_server/default_settings.py +++ b/cas_server/default_settings.py @@ -39,17 +39,19 @@ CAS_COMPONENT_URLS = { "bootstrap3_js": "//maxcdn.bootstrapcdn.com/bootstrap/3.3.6/js/bootstrap.min.js", "html5shiv": "//oss.maxcdn.com/libs/html5shiv/3.7.0/html5shiv.js", "respond": "//oss.maxcdn.com/libs/respond.js/1.4.2/respond.min.js", + "bootstrap4_css": "//stackpath.bootstrapcdn.com/bootstrap/4.4.1/css/bootstrap.min.css", + "bootstrap4_js": "//stackpath.bootstrapcdn.com/bootstrap/4.4.1/js/bootstrap.min.js", "jquery": "//code.jquery.com/jquery.min.js", } #: Path to the template showed on /login then the user is not autenticated. -CAS_LOGIN_TEMPLATE = 'cas_server/login.html' +CAS_LOGIN_TEMPLATE = 'cas_server/bs4/login.html' #: Path to the template showed on /login?service=... then the user is authenticated and has asked #: to be warned before being connected to a service. -CAS_WARN_TEMPLATE = 'cas_server/warn.html' +CAS_WARN_TEMPLATE = 'cas_server/bs4/warn.html' #: Path to the template showed on /login then to user is authenticated. -CAS_LOGGED_TEMPLATE = 'cas_server/logged.html' +CAS_LOGGED_TEMPLATE = 'cas_server/bs4/logged.html' #: Path to the template showed on /logout then to user is being disconnected. -CAS_LOGOUT_TEMPLATE = 'cas_server/logout.html' +CAS_LOGOUT_TEMPLATE = 'cas_server/bs4/logout.html' #: Should we redirect users to /login after they logged out instead of displaying #: :obj:`CAS_LOGOUT_TEMPLATE`. CAS_REDIRECT_TO_LOGIN_AFTER_LOGOUT = False diff --git a/cas_server/static/cas_server/styles.css b/cas_server/static/cas_server/bs3/styles.css similarity index 100% rename from cas_server/static/cas_server/styles.css rename to cas_server/static/cas_server/bs3/styles.css diff --git a/cas_server/static/cas_server/bs4/fa-lock.svg b/cas_server/static/cas_server/bs4/fa-lock.svg new file mode 100644 index 0000000..24b8dc7 --- /dev/null +++ b/cas_server/static/cas_server/bs4/fa-lock.svg @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/cas_server/static/cas_server/bs4/fa-user.svg b/cas_server/static/cas_server/bs4/fa-user.svg new file mode 100644 index 0000000..ac145d3 --- /dev/null +++ b/cas_server/static/cas_server/bs4/fa-user.svg @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/cas_server/static/cas_server/bs4/styles.css b/cas_server/static/cas_server/bs4/styles.css new file mode 100644 index 0000000..4c379a9 --- /dev/null +++ b/cas_server/static/cas_server/bs4/styles.css @@ -0,0 +1,34 @@ +html, body { + height: 100%; + background-color: #eee; +} +.cover-container { + max-width: 50em; +} + +/* Page title */ +#app-name { + color: #000; + text-shadow: 0 .05rem .2rem rgba(255, 255, 255, .5); +} +#app-name img { + width: 110px; + margin-right: 1rem; +} +@media screen and (max-width: 680px) { + #app-name img { + display: block; + margin: auto; + } +} + +/* Add icons to login form */ +/* Font-Awesome attribution is already done inside SVG files */ +.form-signin input[type="text"] { + background: right 1rem top 50% / 5% no-repeat url('fa-user.svg'); + padding-right: 3rem; +} +.form-signin input[type="password"] { + background: right 1rem top 50% / 5% no-repeat url('fa-lock.svg'); + padding-right: 3rem; +} diff --git a/cas_server/templates/cas_server/base.html b/cas_server/templates/cas_server/bs3/base.html similarity index 98% rename from cas_server/templates/cas_server/base.html rename to cas_server/templates/cas_server/bs3/base.html index 9980d38..45b81e7 100644 --- a/cas_server/templates/cas_server/base.html +++ b/cas_server/templates/cas_server/bs3/base.html @@ -13,7 +13,7 @@ {% if settings.CAS_FAVICON_URL %}{% endif %} - +
diff --git a/cas_server/templates/cas_server/form.html b/cas_server/templates/cas_server/bs3/form.html similarity index 100% rename from cas_server/templates/cas_server/form.html rename to cas_server/templates/cas_server/bs3/form.html diff --git a/cas_server/templates/cas_server/logged.html b/cas_server/templates/cas_server/bs3/logged.html similarity index 95% rename from cas_server/templates/cas_server/logged.html rename to cas_server/templates/cas_server/bs3/logged.html index 46e1c9a..ef929d6 100644 --- a/cas_server/templates/cas_server/logged.html +++ b/cas_server/templates/cas_server/bs3/logged.html @@ -1,4 +1,4 @@ -{% extends "cas_server/base.html" %} +{% extends "cas_server/bs3/base.html" %} {% load i18n %} {% block content %} diff --git a/cas_server/templates/cas_server/login.html b/cas_server/templates/cas_server/bs3/login.html similarity index 91% rename from cas_server/templates/cas_server/login.html rename to cas_server/templates/cas_server/bs3/login.html index 51aa19c..6c34c6b 100644 --- a/cas_server/templates/cas_server/login.html +++ b/cas_server/templates/cas_server/bs3/login.html @@ -1,4 +1,4 @@ -{% extends "cas_server/base.html" %} +{% extends "cas_server/bs3/base.html" %} {% load i18n %} {% block ante_messages %} @@ -9,7 +9,7 @@ {% block content %} {% endblock %} diff --git a/cas_server/templates/cas_server/bs4/base.html b/cas_server/templates/cas_server/bs4/base.html new file mode 100644 index 0000000..3d8d0fc --- /dev/null +++ b/cas_server/templates/cas_server/bs4/base.html @@ -0,0 +1,91 @@ +{% load i18n %}{% load static %}{% get_current_language as LANGUAGE_CODE %} + + + + + {% block title %}{% trans "Central Authentication Service" %}{% endblock %} + + {% if settings.CAS_FAVICON_URL %}{% endif %} + + + +
+ {% if auto_submit %}{% endif %} + +
+ {% block ante_messages %}{% endblock %} +
+ {% for message in messages %} +
+

{{message}}

+
+ {% endfor %} + {% block content %}{% endblock %} +
+
+ + {% if settings.CAS_SHOW_POWERED %} + + {% endif %} +
+ + + + + + {% block javascript %}{% endblock %} + + + diff --git a/cas_server/templates/cas_server/bs4/form.html b/cas_server/templates/cas_server/bs4/form.html new file mode 100644 index 0000000..789363e --- /dev/null +++ b/cas_server/templates/cas_server/bs4/form.html @@ -0,0 +1,33 @@ +{% load cas_server %} + +{% for error in form.non_field_errors %} +
+ + {{error}} +
+{% endfor %} + +{% for field in form %}{% if not field|is_hidden %} +
{% spaceless %} + {% if field|is_checkbox %} +
+ {{field}} + +
+ {% else %} + + {{field}} + {% endif %} + {% for error in field.errors %} + {{error}} + {% endfor %} +{% endspaceless %}
+{% else %}{{field}}{% endif %}{% endfor %} diff --git a/cas_server/templates/cas_server/bs4/logged.html b/cas_server/templates/cas_server/bs4/logged.html new file mode 100644 index 0000000..f39cadb --- /dev/null +++ b/cas_server/templates/cas_server/bs4/logged.html @@ -0,0 +1,21 @@ +{% extends "cas_server/bs4/base.html" %} +{% load i18n %} +{% block content %} + + +{% endblock %} + diff --git a/cas_server/templates/cas_server/bs4/login.html b/cas_server/templates/cas_server/bs4/login.html new file mode 100644 index 0000000..2f9c0ae --- /dev/null +++ b/cas_server/templates/cas_server/bs4/login.html @@ -0,0 +1,33 @@ +{% extends "cas_server/bs4/base.html" %} +{% load i18n %} + +{% block ante_messages %} + {% if auto_submit %}{% endif %} +{% endblock %} + +{% block content %} + +{% endblock %} + +{% block javascript_inline %} +jQuery(function( $ ){ + $("#id_warn").click(function(e){ + if($("#id_warn").is(':checked')){ + createCookie("warn", "on", 10 * 365); + } else { + eraseCookie("warn"); + } + }); +}); +{% if auto_submit %}document.getElementById('login_form').submit(); // SUBMIT FORM{% endif %} +{% endblock %} diff --git a/cas_server/templates/cas_server/bs4/logout.html b/cas_server/templates/cas_server/bs4/logout.html new file mode 100644 index 0000000..d881efc --- /dev/null +++ b/cas_server/templates/cas_server/bs4/logout.html @@ -0,0 +1,7 @@ +{% extends "cas_server/bs4/base.html" %} +{% load static %} +{% load i18n %} +{% block content %} + +{% endblock %} + diff --git a/cas_server/templates/cas_server/bs4/warn.html b/cas_server/templates/cas_server/bs4/warn.html new file mode 100644 index 0000000..b8f2439 --- /dev/null +++ b/cas_server/templates/cas_server/bs4/warn.html @@ -0,0 +1,11 @@ +{% extends "cas_server/bs4/base.html" %} +{% load static %} +{% load i18n %} + +{% block content %} + +{% endblock %} From f4b4428b9487e0eb841fcebc4959f650a974da45 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Th=C3=A9ophile=20Bastian?= Date: Thu, 9 Apr 2020 18:57:33 +0200 Subject: [PATCH 04/13] Fix CRYPT-DES hash method for LDAP The LDAP-formatted passwords using [Crypt encoding](https://en.wikipedia.org/wiki/Crypt_(C)) can be hashed in many ways, inlcuding the old and deprecated DES and BSDi methods. The usual formatting for Crypt method consists in $method$salt$pass_hash but those two deprecated methods are not encoded this way, and `get_salt` would fail on those, yielding Error 500. --- cas_server/utils.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/cas_server/utils.py b/cas_server/utils.py index 190c290..9f8a5af 100644 --- a/cas_server/utils.py +++ b/cas_server/utils.py @@ -593,7 +593,9 @@ class LdapHashUserPassword(object): if scheme in cls.schemes_nosalt: return b"" elif scheme == b'{CRYPT}': - return b'$'.join(hashed_passord.split(b'$', 3)[:-1])[len(scheme):] + if b'$' in hashed_passord: + return b'$'.join(hashed_passord.split(b'$', 3)[:-1])[len(scheme):] + return hashed_passord.split(b'}', 1)[-1] else: try: hashed_passord = base64.b64decode(hashed_passord[len(scheme):]) From 5f30d614e52e5f4829e30841626e71bfc6227360 Mon Sep 17 00:00:00 2001 From: Ken Whitesell Date: Thu, 28 May 2020 16:44:14 -0400 Subject: [PATCH 05/13] General editing of README.rst --- README.rst | 165 +++++++++++++++++++++++++++-------------------------- 1 file changed, 83 insertions(+), 82 deletions(-) diff --git a/README.rst b/README.rst index 63aa0bb..3bebaff 100644 --- a/README.rst +++ b/README.rst @@ -6,8 +6,8 @@ CAS Server CAS Server is a Django application implementing the `CAS Protocol 3.0 Specification `_. -By default, the authentication process use django internal users but you can easily -use any sources (see the `Authentication backend`_ section and auth classes in the auth.py file) +By default, the authentication process uses django internal users but you can easily +use any source (see the `Authentication backend`_ section and auth classes in the auth.py file) .. contents:: Table of Contents @@ -16,7 +16,7 @@ Features * Support CAS version 1.0, 2.0, 3.0 * Support Single Sign Out -* Configuration of services via the django Admin application +* Configuration of services via the Django Admin application * Fine control on which user's attributes are passed to which service * Possibility to rename/rewrite attributes per service * Possibility to require some attribute values per service @@ -35,10 +35,10 @@ Dependencies * lxml >= 3.4 * six >= 1.8 -Minimal version of packages dependancy are just indicative and meens that ``django-cas-server`` has +Minimal version of package dependencies are just indicative and means that ``django-cas-server`` has been tested with it. Previous versions of dependencies may or may not work. -Additionally, denpending of the `Authentication backend`_ you plan to use, you may need the following +Additionally, depending on the `Authentication backend`_ you plan to use, you may need the following python packages: * ldap3 @@ -46,9 +46,9 @@ python packages: * mysql-python -Here there is a table with the name of python packages and the corresponding packages providing +Here is a table with the name of python packages and the corresponding packages providing them on debian like systems and centos like systems. -You should try as much as possible to use system packages as there are automatically updated then +You should try as much as possible to use system packages as they are automatically updated when you update your system. You can then install Not Available (N/A) packages on your system using pip inside a virtualenv as described in the `Installation`_ section. For use with python3, just replace python(2) in the table by python3. @@ -126,7 +126,7 @@ The recommended installation mode is to use a virtualenv with ``--system-site-pa `PYTHONPATH `_ (for instance by symlinking ``cas_server`` to the root of your django project). -7. Open ``cas_project/settings.py`` in you favourite editor and follow the quick start section. +7. Open ``cas_project/settings.py`` in your favourite editor and follow the quick start section. Quick start @@ -166,15 +166,15 @@ Quick start ``cas_clean_tickets`` and ``cas_clean_sessions``. * ``clearsessions``: please see `Clearing the session store `_. - * ``cas_clean_tickets``: old tickets and timed-out tickets do not get purge from + * ``cas_clean_tickets``: old tickets and timed-out tickets do not get purged from the database automatically. They are just marked as invalid. ``cas_clean_tickets`` - is a clean-up management command for this purpose. It send SingleLogOut request - to services with timed out tickets and delete them. + is a clean-up management command for this purpose. It sends SingleLogOut requests + to services with timed out tickets and deletes them. * ``cas_clean_sessions``: Logout and purge users (sending SLO requests) that are - inactive since more than ``SESSION_COOKIE_AGE``. The default value for is ``1209600`` + inactive more than ``SESSION_COOKIE_AGE``. The default value is ``1209600`` seconds (2 weeks). You probably should reduce it to something like ``86400`` seconds (1 day). - You could for example do as bellow:: + You could, for example, do as below:: 0 0 * * * cas-user /path/to/project/manage.py clearsessions */5 * * * * cas-user /path/to/project/manage.py cas_clean_tickets @@ -184,7 +184,7 @@ Quick start 6. Start the development server and visit http://127.0.0.1:8000/admin/ to add a first service allowed to authenticate user against the CAS - (you'll need the Admin app enabled). See the `Service Patterns`_ section bellow. + (you'll need the Admin app enabled). See the `Service Patterns`_ section below. 7. Visit http://127.0.0.1:8000/cas/ to login with your django users. @@ -200,12 +200,12 @@ All settings are optional. Add them to ``settings.py`` to customize ``django-cas Template settings ----------------- -* ``CAS_LOGO_URL``: URL to the logo showed in the up left corner on the default - templates. Set it to ``False`` to disable it. +* ``CAS_LOGO_URL``: URL to the logo shown in the upper left corner on the default + template. Set it to ``False`` to disable it. * ``CAS_FAVICON_URL``: URL to the favicon (shortcut icon) used by the default templates. Default is a key icon. Set it to ``False`` to disable it. * ``CAS_SHOW_POWERED``: Set it to ``False`` to hide the powered by footer. The default is ``True``. -* ``CAS_COMPONENT_URLS``: URLs to css and javascript external components. It is a dictionnary +* ``CAS_COMPONENT_URLS``: URLs to css and javascript external components. It is a dictionary having the five following keys: ``"bootstrap3_css"``, ``"bootstrap3_js"``, ``bootstrap4_css``, ``bootstrap4_js``, ``"html5shiv"``, ``"respond"``, ``"jquery"``. The default is:: @@ -220,17 +220,17 @@ Template settings "jquery": "//code.jquery.com/jquery.min.js", } - if you omit some keys of the dictionnary, the default value for these keys is used. + if you omit some keys of the dictionary, the default value for these keys is used. * ``CAS_SHOW_SERVICE_MESSAGES``: Messages displayed about the state of the service on the login page. The default is ``True``. * ``CAS_INFO_MESSAGES``: Messages displayed in info-boxes on the html pages of the default templates. - It is a dictionnary mapping message name to a message dict. A message dict has 3 keys: + It is a dictionary mapping message name to a message dict. A message dict has 3 keys: * ``message``: A unicode message to display, potentially wrapped around ugettex_lazy * ``discardable``: A boolean, specify if the users can close the message info-box - * ``type``: One of info, success, info, warning, danger. The type of the info-box. + * ``type``: One of info, success, warning, danger. The type of the info-box. - ``CAS_INFO_MESSAGES`` contains by default one message, ``cas_explained``, which explain + ``CAS_INFO_MESSAGES`` contains by default one message, ``cas_explained``, which explains roughly the purpose of a CAS. The default is:: { @@ -241,20 +241,20 @@ Template settings u"your session expires or you logout." ), "discardable": True, - "type": "info", # one of info, success, info, warning, danger + "type": "info", # one of info, success, warning, danger }, } * ``CAS_INFO_MESSAGES_ORDER``: A list of message names. Order in which info-box messages are displayed. Use an empty list to disable messages display. The default is ``[]``. -* ``CAS_LOGIN_TEMPLATE``: Path to the template showed on ``/login`` then the user +* ``CAS_LOGIN_TEMPLATE``: Path to the template shown on ``/login`` when the user is not autenticated. The default is ``"cas_server/bs4/login.html"``. -* ``CAS_WARN_TEMPLATE``: Path to the template showed on ``/login?service=...`` then +* ``CAS_WARN_TEMPLATE``: Path to the template shown on ``/login?service=...`` when the user is authenticated and has asked to be warned before being connected to a service. The default is ``"cas_server/bs4/warn.html"``. -* ``CAS_LOGGED_TEMPLATE``: Path to the template showed on ``/login`` then to user is +* ``CAS_LOGGED_TEMPLATE``: Path to the template shown on ``/login`` when the user is authenticated. The default is ``"cas_server/bs4/logged.html"``. -* ``CAS_LOGOUT_TEMPLATE``: Path to the template showed on ``/logout`` then to user +* ``CAS_LOGOUT_TEMPLATE``: Path to the template shown on ``/logout`` when the user is being disconnected. The default is ``"cas_server/bs4/logout.html"`` * ``CAS_REDIRECT_TO_LOGIN_AFTER_LOGOUT``: Should we redirect users to ``/login`` after they logged out instead of displaying ``CAS_LOGOUT_TEMPLATE``. The default is ``False``. @@ -270,23 +270,24 @@ Authentication settings Available classes bundled with ``django-cas-server`` are listed below in the `Authentication backend`_ section. -* ``SESSION_COOKIE_AGE``: This is a django settings. Here, it control the delay in seconds after +* ``SESSION_COOKIE_AGE``: This is a django setting. Here, it controls the delay in seconds after which inactive users are logged out. The default is ``1209600`` (2 weeks). You probably should reduce it to something like ``86400`` seconds (1 day). -* ``CAS_TGT_VALIDITY``: Max time after with the user MUST reauthenticate. Let it to `None` for no - max time.This can be used to force refreshing cached informations only available upon user +* ``CAS_TGT_VALIDITY``: Max time after which the user MUST reauthenticate. Set it to `None` for no + max time. This can be used to force refreshing cached information only available upon user authentication like the user attributes in federation mode or with the ldap auth in bind mode. The default is ``None``. * ``CAS_PROXY_CA_CERTIFICATE_PATH``: Path to certificate authorities file. Usually on linux the local CAs are in ``/etc/ssl/certs/ca-certificates.crt``. The default is ``True`` which - tell requests to use its internal certificat authorities. Settings it to ``False`` should - disable all x509 certificates validation and MUST not be done in production. - x509 certificate validation is perform upon PGT issuance. + tells requests to use its internal certificate authorities. Setting it to ``False`` should + disable all x509 certificate validation and MUST not be done in production. + x509 certificate validation is performed upon PGT issuance. -* ``CAS_SLO_MAX_PARALLEL_REQUESTS``: Maximum number of parallel single log out requests send. - If more requests need to be send, there are queued. The default is ``10``. +* ``CAS_SLO_MAX_PARALLEL_REQUESTS``: Maximum number of parallel single log out requests sent. + If more requests need to be sent, they are queued. The default is ``10``. + * ``CAS_SLO_TIMEOUT``: Timeout for a single SLO request in seconds. The default is ``5``. @@ -295,7 +296,7 @@ Federation settings * ``CAS_FEDERATE``: A boolean for activating the federated mode (see the `Federation mode`_ section below). The default is ``False``. -* ``CAS_FEDERATE_REMEMBER_TIMEOUT``: Time after witch the cookie use for "remember my identity +* ``CAS_FEDERATE_REMEMBER_TIMEOUT``: Time after which the cookie used for "remember my identity provider" expire. The default is ``604800``, one week. The cookie is called ``_remember_provider``. @@ -303,7 +304,7 @@ Federation settings New version warnings settings ----------------------------- -* ``CAS_NEW_VERSION_HTML_WARNING``: A boolean for diplaying a warning on html pages then a new +* ``CAS_NEW_VERSION_HTML_WARNING``: A boolean for diplaying a warning on html pages that a new version of the application is avaible. Once closed by a user, it is not displayed to this user until the next new version. The default is ``True``. * ``CAS_NEW_VERSION_EMAIL_WARNING``: A boolean for sending a email to ``settings.ADMINS`` when a new @@ -324,22 +325,22 @@ Tickets validity settings Tickets miscellaneous settings ------------------------------ -* ``CAS_TICKET_LEN``: Default ticket length. All CAS implementation MUST support ST and PT +* ``CAS_TICKET_LEN``: Default ticket length. All CAS implementations MUST support ST and PT up to 32 chars, PGT and PGTIOU up to 64 chars and it is RECOMMENDED that all tickets up - to 256 chars are supports. Here the default is ``64``. + to 256 chars are supported. Here the default is ``64``. * ``CAS_LT_LEN``: Length of the login tickets. Login tickets are only processed by ``django-cas-server`` - thus there is no length restriction on it. The default is ``CAS_TICKET_LEN``. + thus there are no length restrictions on it. The default is ``CAS_TICKET_LEN``. * ``CAS_ST_LEN``: Length of the service tickets. The default is ``CAS_TICKET_LEN``. - You may need to lower is to ``32`` if you use some old clients. + You may need to lower it to ``32`` if you use some old clients. * ``CAS_PT_LEN``: Length of the proxy tickets. The default is ``CAS_TICKET_LEN``. - This length should be the same as ``CAS_ST_LEN``. You may need to lower is to ``32`` + This length should be the same as ``CAS_ST_LEN``. You may need to lower it to ``32`` if you use some old clients. * ``CAS_PGT_LEN``: Length of the proxy granting tickets. The default is ``CAS_TICKET_LEN``. * ``CAS_PGTIOU_LEN``: Length of the proxy granting tickets IOU. The default is ``CAS_TICKET_LEN``. * ``CAS_LOGIN_TICKET_PREFIX``: Prefix of login tickets. The default is ``"LT"``. * ``CAS_SERVICE_TICKET_PREFIX``: Prefix of service tickets. The default is ``"ST"``. - The CAS specification mandate that service tickets MUST begin with the characters ST + The CAS specification mandates that service tickets MUST begin with the characters ST so you should not change this. * ``CAS_PROXY_TICKET_PREFIX``: Prefix of proxy ticket. The default is ``"PT"``. * ``CAS_PROXY_GRANTING_TICKET_PREFIX``: Prefix of proxy granting ticket. The default is ``"PGT"``. @@ -349,7 +350,7 @@ Tickets miscellaneous settings Mysql backend settings ---------------------- Deprecated, see the `Sql backend settings`_. -Only usefull if you are using the mysql authentication backend: +Only useful if you are using the mysql authentication backend: * ``CAS_SQL_HOST``: Host for the SQL server. The default is ``"localhost"``. * ``CAS_SQL_USERNAME``: Username for connecting to the SQL server. @@ -363,12 +364,12 @@ Only usefull if you are using the mysql authentication backend: * ``CAS_SQL_PASSWORD_CHECK``: The method used to check the user password. Must be one of the following: * ``"crypt"`` (see ), the password in the database - should begin this $ + should begin with $ * ``"ldap"`` (see https://tools.ietf.org/id/draft-stroeder-hashed-userpassword-values-01.html) the password in the database must begin with one of {MD5}, {SMD5}, {SHA}, {SSHA}, {SHA256}, {SSHA256}, {SHA384}, {SSHA384}, {SHA512}, {SSHA512}, {CRYPT}. * ``"hex_HASH_NAME"`` with ``HASH_NAME`` in md5, sha1, sha224, sha256, sha384, sha512. - The hashed password in the database is compare to the hexadecimal digest of the clear + The hashed password in the database is compared to the hexadecimal digest of the clear password hashed with the corresponding algorithm. * ``"plain"``, the password in the database must be in clear. @@ -377,10 +378,10 @@ Only usefull if you are using the mysql authentication backend: Sql backend settings -------------------- -Only usefull if you are using the sql authentication backend. You must add a ``"cas_server"`` +Only useful if you are using the sql authentication backend. You must add a ``"cas_server"`` database to `settings.DATABASES `__ as defined in the django documentation. It is then the database -use by the sql backend. +used by the sql backend. * ``CAS_SQL_USER_QUERY``: The query performed upon user authentication. The username must be in field ``username``, the password in ``password``, @@ -389,61 +390,61 @@ use by the sql backend. * ``CAS_SQL_PASSWORD_CHECK``: The method used to check the user password. Must be one of the following: * ``"crypt"`` (see ), the password in the database - should begin this $ + should begin with $ * ``"ldap"`` (see https://tools.ietf.org/id/draft-stroeder-hashed-userpassword-values-01.html) the password in the database must begin with one of {MD5}, {SMD5}, {SHA}, {SSHA}, {SHA256}, {SSHA256}, {SHA384}, {SSHA384}, {SHA512}, {SSHA512}, {CRYPT}. * ``"hex_HASH_NAME"`` with ``HASH_NAME`` in md5, sha1, sha224, sha256, sha384, sha512. - The hashed password in the database is compare to the hexadecimal digest of the clear + The hashed password in the database is compared to the hexadecimal digest of the clear password hashed with the corresponding algorithm. * ``"plain"``, the password in the database must be in clear. The default is ``"crypt"``. * ``CAS_SQL_PASSWORD_CHARSET``: Charset the SQL users passwords was hash with. This is needed to - encode the user sended password before hashing it for comparison. The default is ``"utf-8"``. + encode the user submitted password before hashing it for comparison. The default is ``"utf-8"``. Ldap backend settings --------------------- -Only usefull if you are using the ldap authentication backend: +Only useful if you are using the ldap authentication backend: * ``CAS_LDAP_SERVER``: Address of the LDAP server. The default is ``"localhost"``. * ``CAS_LDAP_USER``: User bind address, for example ``"cn=admin,dc=crans,dc=org"`` for connecting to the LDAP server. * ``CAS_LDAP_PASSWORD``: Password for connecting to the LDAP server. * ``CAS_LDAP_BASE_DN``: LDAP search base DN, for example ``"ou=data,dc=crans,dc=org"``. -* ``CAS_LDAP_USER_QUERY``: Search filter for searching user by username. User inputed usernames are +* ``CAS_LDAP_USER_QUERY``: Search filter for searching user by username. User entered usernames are escaped using ``ldap3.utils.conv.escape_bytes``. The default is ``"(uid=%s)"`` -* ``CAS_LDAP_USERNAME_ATTR``: Attribute used for users usernames. The default is ``"uid"`` -* ``CAS_LDAP_PASSWORD_ATTR``: Attribute used for users passwords. The default is ``"userPassword"`` +* ``CAS_LDAP_USERNAME_ATTR``: Attribute used for user's usernames. The default is ``"uid"`` +* ``CAS_LDAP_PASSWORD_ATTR``: Attribute used for user's passwords. The default is ``"userPassword"`` * ``CAS_LDAP_PASSWORD_CHECK``: The method used to check the user password. Must be one of the following: * ``"crypt"`` (see ), the password in the database - should begin this $ + should begin with $ * ``"ldap"`` (see https://tools.ietf.org/id/draft-stroeder-hashed-userpassword-values-01.html) the password in the database must begin with one of {MD5}, {SMD5}, {SHA}, {SSHA}, {SHA256}, {SSHA256}, {SHA384}, {SSHA384}, {SHA512}, {SSHA512}, {CRYPT}. * ``"hex_HASH_NAME"`` with ``HASH_NAME`` in md5, sha1, sha224, sha256, sha384, sha512. - The hashed password in the database is compare to the hexadecimal digest of the clear + The hashed password in the database is compared to the hexadecimal digest of the clear password hashed with the corresponding algorithm. * ``"plain"``, the password in the database must be in clear. * ``"bind``, the user credentials are used to bind to the ldap database and retreive the user attribute. In this mode, the settings ``CAS_LDAP_PASSWORD_ATTR`` and ``CAS_LDAP_PASSWORD_CHARSET`` - are ignored, and it is the ldap server that perform password check. The counterpart is that + are ignored, and it is the ldap server that performs the password check. The counterpart is that the user attributes are only available upon user password check and so are cached for later - use. All the other modes directly fetch the user attributes from the database whenever there - are needed. This mean that is you use this mode, they can be some difference between the - attributes in database and the cached ones if changes happend in the database after the user - authentiate. See the parameter ``CAS_TGT_VALIDITY`` to force user to reauthenticate periodically. + use. All the other modes directly fetch the user attributes from the database whenever they + are needed. This mean that is you use this mode, there can be some differences between the + attributes in database and the cached ones if changes happen in the database after the user + authentiates. See the parameter ``CAS_TGT_VALIDITY`` to force user to reauthenticate periodically. The default is ``"ldap"``. -* ``CAS_LDAP_PASSWORD_CHARSET``: Charset the LDAP users passwords was hash with. This is needed to - encode the user sended password before hashing it for comparison. The default is ``"utf-8"``. +* ``CAS_LDAP_PASSWORD_CHARSET``: Charset the LDAP users passwords was hashed with. This is needed to + encode the user submitted password before hashing it for comparison. The default is ``"utf-8"``. Test backend settings --------------------- -Only usefull if you are using the test authentication backend: +Only useful if you are using the test authentication backend: * ``CAS_TEST_USER``: Username of the test user. The default is ``"test"``. * ``CAS_TEST_PASSWORD``: Password of the test user. The default is ``"test"``. @@ -457,19 +458,19 @@ Authentication backend ``django-cas-server`` comes with some authentication backends: -* dummy backend ``cas_server.auth.DummyAuthUser``: all authentication attempt fails. +* dummy backend ``cas_server.auth.DummyAuthUser``: all authentication attempts fail. * test backend ``cas_server.auth.TestAuthUser``: username, password and returned attributes for the user are defined by the ``CAS_TEST_*`` settings. * django backend ``cas_server.auth.DjangoAuthUser``: Users are authenticated against django users system. This is the default backend. The returned attributes are the fields available on the user model. * mysql backend ``cas_server.auth.MysqlAuthUser``: Deprecated, use the sql backend instead. - see the `Mysql backend settings`_ section. The returned attributes are those return by sql query + see the `Mysql backend settings`_ section. The returned attributes are those returned by sql query ``CAS_SQL_USER_QUERY``. * sql backend ``cas_server.auth.SqlAuthUser``: see the `Sql backend settings`_ section. - The returned attributes are those return by sql query ``CAS_SQL_USER_QUERY``. + The returned attributes are those returned by sql query ``CAS_SQL_USER_QUERY``. * ldap backend ``cas_server.auth.LdapAuthUser``: see the `Ldap backend settings`_ section. The returned attributes are those of the ldap node returned by the query filter ``CAS_LDAP_USER_QUERY``. -* federated backend ``cas_server.auth.CASFederateAuth``: It is automatically used then ``CAS_FEDERATE`` is ``True``. +* federated backend ``cas_server.auth.CASFederateAuth``: It is automatically used when ``CAS_FEDERATE`` is ``True``. You should not set it manually without setting ``CAS_FEDERATE`` to ``True``. @@ -547,7 +548,7 @@ Service Patterns In a CAS context, ``Service`` refers to the application the client is trying to access. By extension we use ``service`` for the URL of such an application. -By default, ``django-cas-server`` do not allow any service to use the CAS to authenticate users. +By default, ``django-cas-server`` does not allow any service to use the CAS to authenticate users. In order to allow services, you need to connect to the django admin interface using a django superuser, and add a first service pattern. @@ -560,7 +561,7 @@ A service pattern comes with 9 fields: * ``Pattern``: a regular expression used to match services. * ``User field``: the user attribute to use as username for services matching this service pattern. Leave it empty to use the login name. -* ``Restrict username``: if checked, only login name defined below are allowed to get tickets +* ``Restrict username``: if checked, only login names defined below are allowed to get tickets for services matching this service pattern. * ``Proxy``: if checked, allow the creation of Proxy Ticket for services matching this service pattern. Otherwise, only Service Ticket will be created. @@ -569,25 +570,25 @@ A service pattern comes with 9 fields: Hence you must only check this for trusted services that need it. (For instance, a webmail needs Proxy Ticket to authenticate himself as the user to the imap server). * ``Single log out``: Check it to send Single Log Out requests to authenticated services matching - this service pattern. SLO requests are send to all services the user is authenticated to then - the user disconnect. + this service pattern. SLO requests are sent to all services the user is authenticated to when + the user disconnects. * ``Single log out callback``: The http(s) URL to POST the SLO requests. If empty, the service URL is used. This field is useful to allow non http services (imap, smtp, ftp) to handle SLO requests. A service pattern has 4 associated models: * ``Usernames``: a list of username associated with the ``Restrict username`` field -* ``Replace attribut names``: a list of user attributes to send to the service. Choose the name - used for sending the attribute by setting ``Remplacement`` or leave it empty to leave it unchanged. -* ``Replace attribut values``: a list of sent user attributes for which value needs to be tweak. +* ``Replace attribute names``: a list of user attributes to send to the service. Choose the name + used for sending the attribute by setting ``Replacement`` or leave it empty to leave it unchanged. +* ``Replace attribute values``: a list of sent user attributes for which value needs to be tweaked. Replace the attribute value by the string obtained by replacing the leftmost non-overlapping occurrences of ``pattern`` in string by ``replace``. In ``replace`` backslash escapes are processed. - Matched groups are captures by \1, \2, etc. -* ``Filter attribut values``: a list of user attributes for which value needs to match a regular + Matched groups are captured by \1, \2, etc. +* ``Filter attribute values``: a list of user attributes for which value needs to match a regular expression. For instance, service A may need an email address, and you only want user with an email address to connect to it. To do so, put ``email`` in ``Attribute`` and ``.*`` in ``pattern``. -Then a user ask a ticket for a service, the service URL is compare against each service patterns +When a user asks for a ticket for a service, the service URL is compared against each service pattern sorted by ``position``. The first service pattern that matches the service URL is chosen. Hence, you should give low ``position`` to very specific patterns like ``^https://www\.example\.com(/.*)?$`` and higher ``position`` to generic patterns like ``^https://.*``. @@ -598,9 +599,9 @@ So the service URL ``https://www.examle.com`` will use the service pattern for Federation mode =============== -``django-cas-server`` comes with a federation mode. Then ``CAS_FEDERATE`` is ``True``, -user are invited to choose an identity provider on the login page, then, they are redirected -to the provider CAS to authenticate. This provider transmit to ``django-cas-server`` the user +``django-cas-server`` comes with a federation mode. When ``CAS_FEDERATE`` is ``True``, +users are invited to choose an identity provider on the login page, then, they are redirected +to the provider CAS to authenticate. This provider transmits to ``django-cas-server`` the user username and attributes. The user is now logged in on ``django-cas-server`` and can use services using ``django-cas-server`` as CAS. @@ -640,7 +641,7 @@ Then using federate mode, you should add one command to a daily crontab: ``cas_c This command clean the local cache of federated user from old unused users. -You could for example do as bellow:: +You could for example do as below:: 10 0 * * * cas-user /path/to/project/manage.py cas_clean_federate From 4129687e4184dba876b90277880ed54d905ac492 Mon Sep 17 00:00:00 2001 From: Yohann D'ANELLO Date: Sat, 25 Apr 2020 02:59:37 +0200 Subject: [PATCH 06/13] Support Django 2.2 and 3.0 --- .travis.yml | 8 +++- README.rst | 2 +- cas_server/apps.py | 7 ++- cas_server/default_settings.py | 7 ++- cas_server/forms.py | 7 ++- .../management/commands/cas_clean_federate.py | 7 ++- .../management/commands/cas_clean_sessions.py | 7 ++- .../management/commands/cas_clean_tickets.py | 7 ++- cas_server/models.py | 8 +++- cas_server/utils.py | 3 +- cas_server/views.py | 12 +++-- requirements-dev.txt | 1 - requirements.txt | 2 +- setup.py | 6 ++- tox.ini | 48 +++++++++++++++++++ 15 files changed, 113 insertions(+), 19 deletions(-) diff --git a/.travis.yml b/.travis.yml index d2b02b2..1499e34 100644 --- a/.travis.yml +++ b/.travis.yml @@ -1,9 +1,9 @@ language: python matrix: include: - - python: "3.7" + - python: "3.8" env: TOX_ENV=flake8 - - python: "3.7" + - python: "3.8" env: TOX_ENV=check_rst - python: "2.7" env: TOX_ENV=py27-django111 @@ -20,6 +20,10 @@ matrix: - python: "3.6" env: TOX_ENV=py36-django21 - python: "3.7" + env: TOX_ENV=py37-django22 + - python: "3.8" + env: TOX_ENV=py38-django30 + - python: "3.8" env: TOX_ENV=coverage cache: directories: diff --git a/README.rst b/README.rst index 3bebaff..ce70792 100644 --- a/README.rst +++ b/README.rst @@ -29,7 +29,7 @@ Dependencies ``django-cas-server`` depends on the following python packages: -* Django >= 1.11 < 2.1 +* Django >= 1.11 <= 3.0 * requests >= 2.4 * requests_futures >= 0.9.5 * lxml >= 3.4 diff --git a/cas_server/apps.py b/cas_server/apps.py index 03afab5..29b6616 100644 --- a/cas_server/apps.py +++ b/cas_server/apps.py @@ -9,9 +9,14 @@ # # (c) 2015-2016 Valentin Samir """django config module""" -from django.utils.translation import ugettext_lazy as _ from django.apps import AppConfig +import sys +if sys.version_info < (3, ): + from django.utils.translation import ugettext_lazy as _ +else: + from django.utils.translation import gettext_lazy as _ + class CasAppConfig(AppConfig): """ diff --git a/cas_server/default_settings.py b/cas_server/default_settings.py index 8e72b54..744a6f7 100644 --- a/cas_server/default_settings.py +++ b/cas_server/default_settings.py @@ -12,10 +12,15 @@ """Default values for the app's settings""" from django.conf import settings from django.templatetags.static import static -from django.utils.translation import ugettext_lazy as _ from importlib import import_module +import sys +if sys.version_info < (3, ): + from django.utils.translation import ugettext_lazy as _ +else: + from django.utils.translation import gettext_lazy as _ + try: #: URL to the logo showed in the up left corner on the default templates. diff --git a/cas_server/forms.py b/cas_server/forms.py index 107423c..5749285 100644 --- a/cas_server/forms.py +++ b/cas_server/forms.py @@ -13,11 +13,16 @@ from .default_settings import settings from django import forms from django.forms import widgets -from django.utils.translation import ugettext_lazy as _ import cas_server.utils as utils import cas_server.models as models +import sys +if sys.version_info < (3, ): + from django.utils.translation import ugettext_lazy as _ +else: + from django.utils.translation import gettext_lazy as _ + class BootsrapForm(forms.Form): """ diff --git a/cas_server/management/commands/cas_clean_federate.py b/cas_server/management/commands/cas_clean_federate.py index 795230a..af46457 100644 --- a/cas_server/management/commands/cas_clean_federate.py +++ b/cas_server/management/commands/cas_clean_federate.py @@ -10,10 +10,15 @@ # # (c) 2016 Valentin Samir from django.core.management.base import BaseCommand -from django.utils.translation import ugettext_lazy as _ from ... import models +import sys +if sys.version_info < (3, ): + from django.utils.translation import ugettext_lazy as _ +else: + from django.utils.translation import gettext_lazy as _ + class Command(BaseCommand): args = '' diff --git a/cas_server/management/commands/cas_clean_sessions.py b/cas_server/management/commands/cas_clean_sessions.py index d0c63fe..9e8db52 100644 --- a/cas_server/management/commands/cas_clean_sessions.py +++ b/cas_server/management/commands/cas_clean_sessions.py @@ -11,10 +11,15 @@ # (c) 2016 Valentin Samir """Clean deleted sessions management command""" from django.core.management.base import BaseCommand -from django.utils.translation import ugettext_lazy as _ from ... import models +import sys +if sys.version_info < (3,): + from django.utils.translation import ugettext_lazy as _ +else: + from django.utils.translation import gettext_lazy as _ + class Command(BaseCommand): """Clean deleted sessions""" diff --git a/cas_server/management/commands/cas_clean_tickets.py b/cas_server/management/commands/cas_clean_tickets.py index 3111016..b2869bd 100644 --- a/cas_server/management/commands/cas_clean_tickets.py +++ b/cas_server/management/commands/cas_clean_tickets.py @@ -11,10 +11,15 @@ # (c) 2016 Valentin Samir """Clean old trickets management command""" from django.core.management.base import BaseCommand -from django.utils.translation import ugettext_lazy as _ from ... import models +import sys +if sys.version_info < (3, ): + from django.utils.translation import ugettext_lazy as _ +else: + from django.utils.translation import gettext_lazy as _ + class Command(BaseCommand): """Clean old trickets""" diff --git a/cas_server/models.py b/cas_server/models.py index 657a669..607c048 100644 --- a/cas_server/models.py +++ b/cas_server/models.py @@ -15,9 +15,13 @@ from .default_settings import settings, SessionStore from django.db import models from django.db.models import Q from django.contrib import messages -from django.utils.translation import ugettext_lazy as _ from django.utils import timezone -from django.utils.encoding import python_2_unicode_compatible +try: + from django.utils.encoding import python_2_unicode_compatible + from django.utils.translation import ugettext_lazy as _ +except ImportError: + def python_2_unicode_compatible(f): return f + from django.utils.translation import gettext_lazy as _ from django.core.mail import send_mail import re diff --git a/cas_server/utils.py b/cas_server/utils.py index 9f8a5af..7e9de27 100644 --- a/cas_server/utils.py +++ b/cas_server/utils.py @@ -18,11 +18,12 @@ from django.contrib.messages import constants as DEFAULT_MESSAGE_LEVELS from django.core.serializers.json import DjangoJSONEncoder from django.utils import timezone from django.core.exceptions import ValidationError -from django.utils.translation import ugettext_lazy as _ try: from django.urls import reverse + from django.utils.translation import gettext_lazy as _ except ImportError: from django.core.urlresolvers import reverse + from django.utils.translation import ugettext_lazy as _ import re import random diff --git a/cas_server/views.py b/cas_server/views.py index ff8d144..f1616d4 100644 --- a/cas_server/views.py +++ b/cas_server/views.py @@ -16,12 +16,16 @@ from django.shortcuts import render, redirect from django.http import HttpResponse, HttpResponseRedirect from django.contrib import messages from django.utils.decorators import method_decorator -from django.utils.translation import ugettext as _ from django.utils import timezone from django.views.decorators.csrf import csrf_exempt from django.middleware.csrf import CsrfViewMiddleware from django.views.generic import View -from django.utils.encoding import python_2_unicode_compatible +try: + from django.utils.encoding import python_2_unicode_compatible + from django.utils.translation import ugettext as _ +except ImportError: + def python_2_unicode_compatible(f): return f + from django.utils.translation import gettext as _ from django.utils.safestring import mark_safe try: from django.urls import reverse @@ -256,7 +260,7 @@ class FederateAuth(CsrfExemptView): self.service_url = service_url return CASFederateValidateUser(provider, service_url, renew=renew) - def post(self, request, provider=None): + def post(self, request, provider=None, *args, **kwargs): """ method called on POST request @@ -1395,7 +1399,7 @@ class SamlValidate(CsrfExemptView): ticket = None root = None - def post(self, request): + def post(self, request, *args, **kwargs): """ method called on POST request on this view diff --git a/requirements-dev.txt b/requirements-dev.txt index f92821a..b793b42 100644 --- a/requirements-dev.txt +++ b/requirements-dev.txt @@ -7,6 +7,5 @@ tox>=1.8.1 pytest>=2.6.4 pytest-django>=2.8.0 pytest-pythonpath>=0.3 -pytest-warnings pytest-cov>=2.2.1 mock>=1 diff --git a/requirements.txt b/requirements.txt index 95b36d9..d69cdb7 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,4 +1,4 @@ -Django >= 1.11,<2.2 +Django >= 1.11,<=3.0 setuptools>=5.5 requests>=2.4 requests_futures>=0.9.5 diff --git a/setup.py b/setup.py index 4c4af3b..905b68e 100644 --- a/setup.py +++ b/setup.py @@ -34,6 +34,8 @@ if __name__ == '__main__': 'Framework :: Django :: 1.11', 'Framework :: Django :: 2.0', 'Framework :: Django :: 2.1', + 'Framework :: Django :: 2.2', + 'Framework :: Django :: 3.0', 'Intended Audience :: Developers', 'Intended Audience :: System Administrators', 'License :: OSI Approved :: GNU General Public License v3 (GPLv3)', @@ -44,6 +46,8 @@ if __name__ == '__main__': 'Programming Language :: Python :: 3', 'Programming Language :: Python :: 3.5', 'Programming Language :: Python :: 3.6', + 'Programming Language :: Python :: 3.7', + 'Programming Language :: Python :: 3.8', 'Topic :: Software Development :: Libraries :: Python Modules', 'Topic :: Internet :: WWW/HTTP', 'Topic :: Internet :: WWW/HTTP :: Dynamic Content', @@ -58,7 +62,7 @@ if __name__ == '__main__': }, keywords=['django', 'cas', 'cas3', 'server', 'sso', 'single sign-on', 'authentication', 'auth'], install_requires=[ - 'Django >= 1.11,<2.2', 'requests >= 2.4', 'requests_futures >= 0.9.5', + 'Django >= 1.11,<=3.0', 'requests >= 2.4', 'requests_futures >= 0.9.5', 'lxml >= 3.4', 'six >= 1' ], url="https://github.com/nitmir/django-cas-server", diff --git a/tox.ini b/tox.ini index ff5e1db..5bc8105 100644 --- a/tox.ini +++ b/tox.ini @@ -9,6 +9,13 @@ envlist= py36-django20, py35-django21, py36-django21, + py37-django21, + py36-django22, + py37-django22, + py38-django22, + py36-django30, + py37-django30, + py38-django30, [flake8] max-line-length=100 @@ -118,6 +125,47 @@ deps = Django>=2.1,<2.2 {[base]deps} +[testenv:py37-django21] +basepython=python3.7 +deps = + Django>=2.1,<2.2 + {[base]deps} + +[testenv:py36-django22] +basepython=python3.6 +deps = + Django>=2.2,<3.0 + {[base]deps} + +[testenv:py37-django22] +basepython=python3.7 +deps = + Django>=2.2,<3.0 + {[base]deps} + +[testenv:py38-django22] +basepython=python3.8 +deps = + Django>=2.2,<3.0 + {[base]deps} + +[testenv:py36-django30] +basepython=python3.6 +deps = + Django>=3.0,<3.1 + {[base]deps} + +[testenv:py37-django30] +basepython=python3.7 +deps = + Django>=3.0,<3.1 + {[base]deps} + +[testenv:py38-django30] +basepython=python3.8 +deps = + Django>=3.0,<3.1 + {[base]deps} [testenv:flake8] From 9cd44aa8aac5e4143edd7e99dff143a8b9c3fc31 Mon Sep 17 00:00:00 2001 From: Yohann D'ANELLO Date: Sat, 25 Apr 2020 03:14:01 +0200 Subject: [PATCH 07/13] Code quality --- .travis.yml | 2 ++ cas_server/models.py | 6 +++++- cas_server/views.py | 6 +++++- 3 files changed, 12 insertions(+), 2 deletions(-) diff --git a/.travis.yml b/.travis.yml index 1499e34..7f0543b 100644 --- a/.travis.yml +++ b/.travis.yml @@ -21,6 +21,8 @@ matrix: env: TOX_ENV=py36-django21 - python: "3.7" env: TOX_ENV=py37-django22 + - python: "3.8" + env: TOX_ENV=py38-django22 - python: "3.8" env: TOX_ENV=py38-django30 - python: "3.8" diff --git a/cas_server/models.py b/cas_server/models.py index 607c048..b8950a6 100644 --- a/cas_server/models.py +++ b/cas_server/models.py @@ -20,7 +20,11 @@ try: from django.utils.encoding import python_2_unicode_compatible from django.utils.translation import ugettext_lazy as _ except ImportError: - def python_2_unicode_compatible(f): return f + def python_2_unicode_compatible(func): + """ + We use Django >= 3.0 with Python >= 3.4, we don't need Python 2 compatibility. + """ + return func from django.utils.translation import gettext_lazy as _ from django.core.mail import send_mail diff --git a/cas_server/views.py b/cas_server/views.py index f1616d4..a1f2873 100644 --- a/cas_server/views.py +++ b/cas_server/views.py @@ -24,7 +24,11 @@ try: from django.utils.encoding import python_2_unicode_compatible from django.utils.translation import ugettext as _ except ImportError: - def python_2_unicode_compatible(f): return f + def python_2_unicode_compatible(func): + """ + We use Django >= 3.0 with Python >= 3.4, we don't need Python 2 compatibility. + """ + return func from django.utils.translation import gettext as _ from django.utils.safestring import mark_safe try: From b7c7c0f0ba8ed0f9a5aae941889e2f6616085926 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Th=C3=A9ophile=20Bastian?= Date: Tue, 14 Apr 2020 23:47:08 +0200 Subject: [PATCH 08/13] Service URL: keep blank GET arguments When a service URL contains GET arguments with no associated value, eg http://example.com/?foo=a&bar only the arguments with value are kept, yielding http://example.com/?foo=a&ticket= losing `bar` in the process --- cas_server/utils.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cas_server/utils.py b/cas_server/utils.py index 7e9de27..f2bb4db 100644 --- a/cas_server/utils.py +++ b/cas_server/utils.py @@ -259,7 +259,7 @@ def update_url(url, params): value = value.encode('utf-8') params[key] = value url_parts = list(urlparse(url)) - query = dict(parse_qsl(url_parts[4])) + query = dict(parse_qsl(url_parts[4], keep_blank_values=True)) query.update(params) # make the params order deterministic query = list(query.items()) From 87672dda05fb5108a59b6ab63642940f08f671fb Mon Sep 17 00:00:00 2001 From: Valentin Samir Date: Sun, 5 Jul 2020 14:52:55 +0200 Subject: [PATCH 09/13] Allow patch release of Django 3.0 in requirements.txt --- requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index d69cdb7..22b409b 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,4 +1,4 @@ -Django >= 1.11,<=3.0 +Django >= 1.11,<3.1 setuptools>=5.5 requests>=2.4 requests_futures>=0.9.5 From 78b18a5b643a219ff8e70da790949285ed8d8c31 Mon Sep 17 00:00:00 2001 From: Valentin Samir Date: Sun, 5 Jul 2020 15:02:10 +0200 Subject: [PATCH 10/13] Allow patch release of Django 3.0 in setup.py --- setup.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/setup.py b/setup.py index 905b68e..38cfb70 100644 --- a/setup.py +++ b/setup.py @@ -62,7 +62,7 @@ if __name__ == '__main__': }, keywords=['django', 'cas', 'cas3', 'server', 'sso', 'single sign-on', 'authentication', 'auth'], install_requires=[ - 'Django >= 1.11,<=3.0', 'requests >= 2.4', 'requests_futures >= 0.9.5', + 'Django >= 1.11,<3.1', 'requests >= 2.4', 'requests_futures >= 0.9.5', 'lxml >= 3.4', 'six >= 1' ], url="https://github.com/nitmir/django-cas-server", From 6a82f8654cffcc4babe44b5f51766cd947e9fd3b Mon Sep 17 00:00:00 2001 From: Valentin Samir Date: Sun, 5 Jul 2020 15:07:18 +0200 Subject: [PATCH 11/13] Drop support for Django 2.0 and 2.1 (EOL) --- tox.ini | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/tox.ini b/tox.ini index 5bc8105..c398c06 100644 --- a/tox.ini +++ b/tox.ini @@ -5,11 +5,7 @@ envlist= py27-django111, py35-django111, py36-django111, - py35-django20, - py36-django20, - py35-django21, - py36-django21, - py37-django21, + py37-django111, py36-django22, py37-django22, py38-django22, From 85a022686b96e22a854e2ca779989313bfbd7959 Mon Sep 17 00:00:00 2001 From: Valentin Samir Date: Sun, 5 Jul 2020 15:17:56 +0200 Subject: [PATCH 12/13] Update README for python3 by default --- README.rst | 59 +++++++++++++++++++++++++----------------------------- 1 file changed, 27 insertions(+), 32 deletions(-) diff --git a/README.rst b/README.rst index ce70792..87b663f 100644 --- a/README.rst +++ b/README.rst @@ -21,7 +21,7 @@ Features * Possibility to rename/rewrite attributes per service * Possibility to require some attribute values per service * Federated mode between multiple CAS -* Supports Django 1.11 and 2.0 +* Supports Django 1.11, 2.2 and 3.0 * Supports Python 2.7, 3.5+ Dependencies @@ -29,7 +29,7 @@ Dependencies ``django-cas-server`` depends on the following python packages: -* Django >= 1.11 <= 3.0 +* Django >= 1.11 < 3.1 * requests >= 2.4 * requests_futures >= 0.9.5 * lxml >= 3.4 @@ -50,28 +50,28 @@ Here is a table with the name of python packages and the corresponding packages them on debian like systems and centos like systems. You should try as much as possible to use system packages as they are automatically updated when you update your system. You can then install Not Available (N/A) -packages on your system using pip inside a virtualenv as described in the `Installation`_ section. -For use with python3, just replace python(2) in the table by python3. +packages on your system using pip3 inside a virtualenv as described in the `Installation`_ section. +For use with python2, just replace python3(6) in the table by python. -+------------------+-------------------------+---------------------+ -| python package | debian like systems | centos like systems | -+==================+=========================+=====================+ -| Django | python-django | python-django | -+------------------+-------------------------+---------------------+ -| requests | python-requests | python-requests | -+------------------+-------------------------+---------------------+ -| requests_futures | python-requests-futures | N/A | -+------------------+-------------------------+---------------------+ -| lxml | python-lxml | python-lxml | -+------------------+-------------------------+---------------------+ -| six | python-six | python-six | -+------------------+-------------------------+---------------------+ -| ldap3 | python-ldap3 | python-ldap3 | -+------------------+-------------------------+---------------------+ -| psycopg2 | python-psycopg2 | python-psycopg2 | -+------------------+-------------------------+---------------------+ -| mysql-python | python-mysqldb | python2-mysql | -+------------------+-------------------------+---------------------+ ++------------------+--------------------------+---------------------+ +| python package | debian like systems | centos like systems | ++==================+==========================+=====================+ +| Django | python3-django | python36-django | ++------------------+--------------------------+---------------------+ +| requests | python3-requests | python36-requests | ++------------------+--------------------------+---------------------+ +| requests_futures | python3-requests-futures | N/A | ++------------------+--------------------------+---------------------+ +| lxml | python3-lxml | python36-lxml | ++------------------+--------------------------+---------------------+ +| six | python3-six | python36-six | ++------------------+--------------------------+---------------------+ +| ldap3 | python3-ldap3 | python36-ldap3 | ++------------------+--------------------------+---------------------+ +| psycopg2 | python3-psycopg2 | python36-psycopg2 | ++------------------+--------------------------+---------------------+ +| mysql-python | python3-mysqldb | python36-mysql | ++------------------+--------------------------+---------------------+ Installation ============ @@ -84,23 +84,18 @@ The recommended installation mode is to use a virtualenv with ``--system-site-pa On debian like systems:: - $ sudo apt-get install python-django python-requests python-six python-lxml python-requests-futures + $ sudo apt-get install python3-django python3-requests python3-six python3-lxml python3-requests-futures On debian jessie, you can use the version of python-django available in the `backports `_. - On centos like systems:: + On centos like systems with epel enabled:: - $ sudo yum install python-django python-requests python-six python-lxml + $ sudo yum install python36-django python36-requests python36-six python36-lxml 3. Create a virtualenv:: - $ virtualenv --system-site-packages cas_venv - Running virtualenv with interpreter /var/www/html/cas-server/bin/python2 - Using real prefix '/usr' - New python executable in cas/bin/python2 - Also creating executable in cas/bin/python - Installing setuptools, pip...done. + $ virtualenv -p python3 --system-site-packages cas_venv 4. And `activate it `__:: From c3e2fdecfea14b74183054d290c1c21d86f4d413 Mon Sep 17 00:00:00 2001 From: Valentin Samir Date: Sun, 5 Jul 2020 15:27:15 +0200 Subject: [PATCH 13/13] Update to version 1.2.0 --- CHANGELOG.rst | 32 ++++++++++++++++++++++++++++++++ cas_server/__init__.py | 2 +- 2 files changed, 33 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.rst b/CHANGELOG.rst index 8c4666a..d493dd9 100644 --- a/CHANGELOG.rst +++ b/CHANGELOG.rst @@ -6,6 +6,38 @@ All notable changes to this project will be documented in this file. .. contents:: Table of Contents :depth: 2 +v1.2.0 - 2020-07-05 +=================== + +Added +----- + +* Bootstrap 4 templates +* Support for Django 2.2 and 3.0 + +Fixes +----- + +* Replace calls to add_description_unit. As of Sphinx 2.4, the deprecated + add_description_unit function has been removed. +* Fix CRYPT-DES hash method for LDAP +* Fix various spelling miskate in README.rst +* Service URL: keep blank GET arguments + +Changed +------- + +* Use python3 for flake8, check_rst and coverage +* Update README.rst quickstart for using python3 by default + +Removed +------- + +* Drop support for Django 2.0 and 2.1 as it reached end of life. + We still keep Django 1.11 as it is the last supported release + by python2 AND the currently packaged version of Django in + Debian Buster (current stable). + v1.1.0 - 2019-03-02 =================== diff --git a/cas_server/__init__.py b/cas_server/__init__.py index 26a5bcd..66d4a2c 100644 --- a/cas_server/__init__.py +++ b/cas_server/__init__.py @@ -11,7 +11,7 @@ """A django CAS server application""" #: version of the application -VERSION = '1.1.0' +VERSION = '1.2.0' #: path the the application configuration class default_app_config = 'cas_server.apps.CasAppConfig'